diff --git a/src/main/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfigurator.java b/src/main/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfigurator.java
index 73aeac8..6e068be 100644
--- a/src/main/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfigurator.java
+++ b/src/main/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfigurator.java
@@ -10,6 +10,7 @@
 import io.jenkins.plugins.casc.ConfigurationContext;
 import io.jenkins.plugins.casc.ConfiguratorException;
 import io.jenkins.plugins.casc.RootElementConfigurator;
+import io.jenkins.plugins.casc.SecretSourceResolver;
 import io.jenkins.plugins.casc.model.CNode;
 import io.jenkins.plugins.casc.model.Mapping;
 import io.jenkins.plugins.casc.model.Scalar;
@@ -56,7 +57,10 @@ public String getDisplayName() {
     protected AdvisorGlobalConfiguration instance(Mapping mapping, ConfigurationContext configurationContext)
             throws ConfiguratorException {
         // Scalar values
-        final String email = (mapping.get(EMAIL_ATTR) != null ? mapping.getScalarValue(EMAIL_ATTR) : StringUtils.EMPTY);
+        final String email = configurationContext
+                .getSecretSourceResolver()
+                .resolve((mapping.get(EMAIL_ATTR) != null ? mapping.getScalarValue(EMAIL_ATTR) : StringUtils.EMPTY));
+
         final boolean nagDisabled = (mapping.get(NAG_DISABLED_ATTR) != null
                 && BooleanUtils.toBoolean(mapping.getScalarValue(NAG_DISABLED_ATTR)));
         final boolean acceptToS = (mapping.get(ACCEPT_TOS_ATTR) != null
@@ -69,7 +73,9 @@ protected AdvisorGlobalConfiguration instance(Mapping mapping, ConfigurationCont
             if (ccCN instanceof Sequence) {
                 Sequence s = (Sequence) ccCN;
                 for (CNode cNode : s) {
-                    cc.add(new Recipient(cNode.asScalar().getValue()));
+                    cc.add(new Recipient(configurationContext
+                            .getSecretSourceResolver()
+                            .resolve(cNode.asScalar().getValue())));
                 }
                 // We don't want to process it anymore because the mapping in YAML
                 // doesn't map the objects model (List<String> vs List<Recipient>
@@ -151,13 +157,15 @@ public CNode describe(AdvisorGlobalConfiguration instance, ConfigurationContext
                         mapping.put(ACCEPT_TOS_ATTR, attribute.describe(instance, context));
                         break;
                     case EMAIL_ATTR:
-                        mapping.put(EMAIL_ATTR, attribute.describe(instance, context));
+                        mapping.put(EMAIL_ATTR, String.valueOf(attribute.describe(instance, context)));
                         break;
                     case CCS_ATTR:
                         // We build it manually because we don't want to expose the Bean model
+                        SecretSourceResolver r = context.getSecretSourceResolver();
                         Sequence ccs = new Sequence();
                         instance.getCcs().stream()
                                 .map(Recipient::getEmail)
+                                .map(r::encode)
                                 .map(Scalar::new)
                                 .forEach(ccs::add);
                         if (!ccs.isEmpty()) {
diff --git a/src/test/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfiguratorTest.java b/src/test/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfiguratorTest.java
index 45a9630..a73585b 100644
--- a/src/test/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfiguratorTest.java
+++ b/src/test/java/com/cloudbees/jenkins/plugins/advisor/casc/AdvisorRootConfiguratorTest.java
@@ -8,6 +8,7 @@
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.arrayContainingInAnyOrder;
 import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.equalTo;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
@@ -32,6 +33,7 @@
 import org.junit.ClassRule;
 import org.junit.Rule;
 import org.junit.Test;
+import org.junit.contrib.java.lang.system.EnvironmentVariables;
 import org.junit.rules.ExpectedException;
 import org.jvnet.hudson.test.JenkinsRule;
 
@@ -50,6 +52,9 @@ public class AdvisorRootConfiguratorTest {
     @Rule
     public final ExpectedException thrown = ExpectedException.none();
 
+    @Rule
+    public final EnvironmentVariables environment = new EnvironmentVariables();
+
     private AdvisorRootConfigurator configurator;
     private AdvisorGlobalConfiguration configuration;
     private Mapping mapping;
@@ -159,6 +164,31 @@ public void testDescribeWithBlankEmail() throws Exception {
         assertTrue(described.isEmpty());
     }
 
+    @Test
+    public void testDescribeWithVarialbeValue() throws Exception {
+        List<Recipient> cc_with_var = Arrays.asList(new Recipient("${admin_cc}"), new Recipient("${admin_cc}"));
+        final AdvisorGlobalConfiguration c = new AdvisorGlobalConfiguration("${admin_email}", cc_with_var, EXCLUDED);
+        c.setAcceptToS(ACCEPT_TOS);
+        c.setNagDisabled(NAG_DISABLED);
+
+        Mapping described = configurator.describe(c, context).asMapping();
+        assertNotNull(described);
+        String email = described.getScalarValue(EMAIL_ATTR);
+
+        assertEquals("^${admin_email}", email);
+        assertTrue(
+                "encoded email cc not found in list",
+                toListValues(described.get(CCS_ATTR).asSequence()).stream().anyMatch(cc -> cc.equals("^${admin_cc}")));
+    }
+
+    @Test
+    public void testResolveWithVariableName() throws Exception {
+        ConfiguratorRegistry registry = ConfiguratorRegistry.get();
+        context = new ConfigurationContext(registry);
+        environment.set("admin_email", "mike@is.cool.com");
+        assertThat(context.getSecretSourceResolver().resolve("${admin_email}"), equalTo("mike@is.cool.com"));
+    }
+
     @Test
     public void testDescribeWithEmptyCC() throws Exception {
         final AdvisorGlobalConfiguration c =